Comment · Thu, August 12, 2021 · ND Owner
DDOS Attack
Original post in this thread
MisterYouAreSoDumb · 137 points
Yesterday we were hit with an extremely sophisticated DDOS attack. This group of people was able to get around multiple DDOS protection systems that were in place. We were down for over for over 4 hours, and everything we did to counteract them was immediately sidestepped. We would cut off access from all IPs in the countries we were getting requests from (like Russia, China, and Brazil) and their systems would automatically shift to other countries within seconds (like Pakistan, Ukraine, Saudi Arabia, and Syria). To stop our server from being overloaded by the attack, we had to put Cloudflare bot checking in place on the site, so you may notice a Cloudflare message pop up when you try to load our site at the moment. That is a JavaScript that assesses if your traffic is legitimate, or if it is part of the attacking systems. Don't be alarmed. That is just Cloudflare's systems doing a quick check. Furthermore, we had to completely cut off access from IPs in almost every country in the world for a period. We have been slowly removing those restrictions as we are able to. However, if you get a message that you are unable to load the site, that is due to the current attack we are deali…
What they were answering
Majalisk · 2 points
Yeah, always important to have limitations like that in case (almost inevitable in many businesses even small) someone does fall prey to a phishing attack. Figured you’d have that too.
BUT, have you bothered to try putting on a fake mustache, a nerd getup with pocket-protector and all and seen if you could make it in as the ‘computer guy’ and get a USB inserted? Lol
Some amusing stories and even videos done by pentesting groups of that being faaaar too successful at businesses, including banks. Once you get around to having a storefront someday, maybe, this will legitimately be something you may contract out for.
u/MisterYouAreSoDumb · ND Owner
Ohh nobody can enter our facility without authorization now. Everyone has electronic badges with their pictures on them that open the electronic locks around the facility. Everyone's department is listed at the top of the badges, and people know who is supposed to be in their department. We've had some people try to get in, but my team stopped them. They have training on preventing unauthorized physical access to the facility, too. We also have video surveillance everywhere now. We've dealt with tons of crazy shit over the years, and have built processes and procedures around many potential issues.